PCI DSS v4.0.1
Payment Card Industry Data Security Standard, version 4.0.1
PCI DSS is the PCI Security Standards Council's security standard for entities that store, process or transmit cardholder data. It is an industry standard rather than a statute: whether an entity must comply is decided by organizations that manage compliance programs, such as a payment brand or acquirer. Version 4.0.1, published in June 2024, is a limited revision with corrections and clarifications and no added or deleted requirements; v4.0 was retired on December 31, 2024. Requirement 8 is the identity core: unique IDs, 12-character passwords, MFA for all access into the cardholder data environment (CDE), and MFA systems that resist replay and cannot be bypassed. The requirements that v4.0 introduced as future-dated, including MFA for all CDE access, have been mandatory since March 31, 2025.
Who it applies to
Entities that store, process or transmit cardholder data, including merchants, processors, acquirers, issuers and service providers involved in payment card processing.
Identity requirements
- Assign every user a unique ID before access to system components or cardholder data, and use group, shared or generic accounts only when necessary on an exception basis (8.2.1 and 8.2.2)
- Revoke access for terminated users immediately, remove or disable inactive user accounts within 90 days, and require re-authentication after 15 minutes of session inactivity (8.2.5, 8.2.6 and 8.2.8)
- Lock out a user ID after no more than 10 invalid attempts for at least 30 minutes or until identity is confirmed, and require passwords of at least 12 characters (8 if the system cannot support 12) with numbers and letters (8.3.4 and 8.3.6)
- Where passwords are the only factor, change them at least every 90 days or analyze account security posture dynamically to decide access in real time (8.3.9)
- Implement MFA for all non-console administrative access into the CDE, for all access into the CDE, and for all remote network access from outside the entity's network that could access or affect the CDE (8.4.1, 8.4.2 and 8.4.3)
- Configure MFA so it is not susceptible to replay, cannot be bypassed without a documented, time-limited management exception, uses at least two different factor types, and requires all factors to succeed before access is granted (8.5.1)
- Prevent interactive use of system and application accounts except in exceptional cases, keep their passwords out of scripts and source code, and review all user accounts and access privileges at least once every six months (8.6.1 to 8.6.3 and 7.2.4)
How it impacts identity systems
| Identity area | Impact |
|---|---|
| Authentication & MFA | MFA covers all access into the CDE, not just administrators and remote users. PCI SSC FAQ 1595 (May 2025) accepts FIDO2-compliant synced passkeys as a single phishing-resistant factor for 8.4.2, while FAQ 1596 says phishing-resistant authentication alone does not satisfy 8.4.1 or 8.4.3. |
| Privileged access (PAM) | Non-console administrative access needs its own MFA even after a user has used MFA for remote access, and system and application accounts must not be used interactively except in documented exceptional cases. |
| Identity governance (IGA) | Immediate revocation on termination, 90-day removal of inactive accounts and six-monthly reviews of all user and third-party accounts set fixed governance clocks. |
| Customer identity & consent (CIAM) | The MFA requirements apply to all types of system components, including cloud and hosted systems, and to web-based access to an application or function, so hosted payment applications and their admin consoles are in scope. |
Penalties
PCI DSS itself sets no fines. PCI SSC says whether an entity is required to comply is at the discretion of organizations that manage compliance programs, such as a payment brand, acquirer or other entity, so consequences for non-compliance come from those programs.
Status and dates last verified against primary sources on 2026-11-05.
PCI DSS v4.0.1: frequently asked questions
- Does PCI DSS v4.0.1 require MFA for all access to the CDE?
- Yes. Requirement 8.4.2 requires MFA for all access into the cardholder data environment and became mandatory on March 31, 2025. It does not apply to application or system accounts performing automated functions or to point-of-sale accounts that can access only one card number at a time. Version 4.0.1 added an applicability note that MFA for all non-administrative access into the CDE does not apply to user accounts authenticated only with phishing-resistant factors.
- Are passkeys acceptable for PCI DSS MFA?
- For Requirement 8.4.2, PCI SSC FAQ 1595 (May 2025) says synced passkeys implemented to FIDO2 requirements are phishing-resistant and may be used as a single factor in place of MFA. For non-console administrative access (8.4.1) and remote network access (8.4.3), FAQ 1596 says phishing-resistant authentication must be combined with another factor.
- What changed in PCI DSS v4.0.1?
- PCI SSC describes v4.0.1, published in June 2024, as a limited revision that corrects formatting and typographical errors and clarifies the focus and intent of some requirements, with no added or deleted requirements. It did not change the March 31, 2025 effective date for the future-dated requirements.